Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5775 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Qlik Sense Scheduler (scheduler.exe) Spawning PowerShell/cmd Reverse Shell — TL-2026-5775

Detects the Qlik Sense Scheduler service (scheduler.exe) spawning PowerShell, pwsh or cmd.exe, the execution pattern seen in the October 2026 Cynet-observed attempts against EU Qlik Sense servers (Nishang Invoke-PowerShellTcpOneLine one-liner calling back to 45.115.26.23:4455) and in the 2023 CACTUS Qlik Sense intrusions (CVE-2023-41265 / CVE-2023-41266 / CVE-2023-48365). The Scheduler has no legitimate reason to launch an interactive shell, so the parent/child pairing is the primary signal; reverse-shell command-line markers raise confidence. Initial access vector for 2026 is unknown, so this rule is behaviour-first and exploit-agnostic.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.001
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*scheduler.exe" (Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*cmd.exe")
| eval reverse_shell_marker=if(match(CommandLine,"(?i)(TCPClient|GetStream|45[.]115[.]26[.]23|Invoke-PowerShellTcpOneLine|-enc|-EncodedCommand|DownloadString)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by host ParentImage Image reverse_shell_marker
| convert ctime(first_seen) ctime(last_seen)
| sort - reverse_shell_marker, - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "scheduler.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| extend ReverseShellMarker = ProcessCommandLine has_any ("TCPClient", "GetStream", "45.115.26.23", "Invoke-PowerShellTcpOneLine", "-EncodedCommand", "DownloadString")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReverseShellMarker
| order by Timestamp desc

Sigma

title: Qlik Sense Scheduler Spawning PowerShell or Command Shell
id: 3b7e1c52-8d4a-4f6e-9a21-5c0d7e8f1a01
status: experimental
description: Detects scheduler.exe (Qlik Sense Scheduler service) spawning powershell, pwsh or cmd, as seen in TL-2026-5775 (Nishang one-line reverse shell to 45.115.26.23:4455) and the 2023 CACTUS Qlik Sense intrusions.
references:
  - https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html
  - https://www.arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - cve.2023.41265
  - cve.2023.41266
  - cve.2023.48365
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\scheduler.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom Qlik Sense task scripts that deliberately invoke cmd.exe or PowerShell from the Scheduler
level: high

Known false positives:

• Qlik Sense administrators running custom task scripts that intentionally launch cmd.exe or PowerShell from the Scheduler service
• Qlik Sense upgrade or patching routines that invoke helper shell commands under scheduler.exe

Tuning notes: Restrict to Qlik Sense hosts via a host lookup or tag. Allowlist documented task-script command lines in the stats clause. Escalate immediately when reverse_shell_marker=yes or the host has any outbound connection to 45.115.26.23. Pair with TL-2026-5775-SPL-003 for C2 correlation.

• 🔒 ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Service Spawning Shells or Download Utilities · unlock with TL Creds
• 🔒 Rogue OpenSSH sshd Installation, Automatic Start and Inbound TCP/22 Firewall Rule · unlock with TL Creds
• 🔒 Tool Staging Retrieval From [indicator]:8012 (Go Backdoor, SSH Scripts, Exploit Toolchains) · unlock with TL Creds
• 🔒 Nishang Invoke-PowerShellTcpOneLine Reverse Shell via PowerShell Script Block Logging · unlock with TL Creds
• 🔒 Linux Credential File Read and ActiveMQ Process/System Discovery by Go Backdoor · unlock with TL Creds
• 🔒 Successful Inbound SSH Logon Against Windows OpenSSH Server (Rogue sshd Persistence Use) · unlock with TL Creds
• 🔒 WinUpdCheck Scheduled Task and [indicator] Reverse-Shell Persistence · unlock with TL Creds
• 🔒 Outbound C2 to [indicator] / TCP 4455-4456 With Beacon Interval Analysis · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5775.

Sample indicators (1 of 16)

• IP address: 45.115.26[.]23

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

Technical analysis

The activity partly overlaps with the 2023 CACTUS-linked Qlik Sense intrusions documented by Arctic Wolf, but the initial-access vulnerability is unknown and the actor is unidentified.

In October 2026 Cynet's CyOps and Research teams observed attempts against Qlik Sense servers at several EU-based customers. Within a window of just over three minutes, the targets saw a one-line PowerShell reverse shell, based on the public Nishang script Invoke-PowerShellTcpOneLine.ps1, connect to 45.115.26.23 on TCP/4455. The command ran under scheduler.exe (the Qlik Sense Scheduler service), which resembles the 2023 CACTUS Qlik intrusions. Cynet blocked these attempts. Cynet states that the exploit used for initial access is currently not known.

Cynet's testing of the staging infrastructure showed the PowerShell shell being used to deliver a Windows Go reverse shell that connects to 45.115.26.23:4456. The Go backdoor searches for running Apache ActiveMQ processes. On Linux it also collects system information and reads /etc/shadow and /etc/passwd. A persistence variant installs OpenSSH: if sshd is unavailable it downloads OpenSSH-Win64.zip from the staging server (a legitimate OpenSSH package reused by the operator), extracts it and runs install-sshd.ps1. It then sets sshd to start automatically, starts the service and adds an inbound firewall rule for TCP/22. It also creates a scheduled task named WinUpdCheck that launches a PowerShell reverse shell from C:\ProgramData\ssh\winc.ps1 every five minutes.

The same host exposes a directory listing on TCP/8012 containing the custom Go backdoor, SSH persistence scripts, an Apache ActiveMQ exploit for CVE-2023-46604 and a modified version of the public watchTowr Veeam CVE-2024-40711 toolchain. Cynet assesses that the operator may be preparing broader attacks. The Qlik Sense Enterprise for Windows flaws CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365 (DoubleQlik, an incomplete fix for CVE-2023-41265) were used by CACTUS operators in 2023 and are cited as context; they are not confirmed as the 2026 initial access vector.

Attribution is weak. The 2026 activity shares only some overlap with the November 2023 CACTUS campaign (Arctic Wolf), in which operators abused the Qlik Sense Scheduler to spawn processes and then deployed ManageEngine UEMS, AnyDesk and Plink, used an RDP tunnel, exfiltrated with rclone and deployed CACTUS ransomware. No file hashes were published for the 2026 activity. BeaconBeagle was queried for the C2 IP during research but returned HTTP 502, so no C2 correlation was obtained.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow

Lateral Movement

T1021.004 Remote Services: SSH

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell

Command and Control

T1095 Non-Application Layer Protocol; T1571 Non-Standard Port

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1686 Disable or Modify System Firewall

Remediation

Patches

• Qlik Sense Enterprise for Windows: upgrade to August 2023 Patch 2 or later (CVE-2023-48365 fixed in Aug 2023 P2, May 2023 P6, Feb 2023 P10, Nov 2022 P12, Aug 2022 P14, May 2022 P16, Feb 2022 P15, Nov 2021 P17)
• Apache ActiveMQ: upgrade to 5.15.16, 5.16.7, 5.17.6 or 5.18.3 or later (CVE-2023-46604)
• Veeam Backup & Replication: upgrade to 12.2.0.334 or later (CVE-2024-40711, see Veeam KB4649)

Immediate actions

• Block 45.115.26.23 (TCP 4455, 4456, 8012) at perimeter and egress
• Hunt for scheduled task WinUpdCheck and file C:\ProgramData\ssh\winc.ps1 on Windows servers, especially Qlik Sense hosts
• Hunt for unexpected sshd installation, OpenSSH-Win64.zip, install-sshd.ps1 and new inbound firewall rules for TCP/22
• Investigate PowerShell child processes spawned by Qlik Sense Scheduler (scheduler.exe)

Workarounds

• Restrict network access to Qlik Sense Proxy/Repository, ActiveMQ OpenWire (61616) and Veeam services to trusted management networks
• Remove unauthorized sshd services and firewall rules, and rotate credentials on any host where WinUpdCheck is found

Longer-term hardening

• Do not expose Qlik Sense, ActiveMQ OpenWire or Veeam services directly to the internet
• Restrict outbound connections from servers to non-standard ports and deploy EDR with behavioral detection of PowerShell reverse shells
• Enable PowerShell script block logging and alert on reverse-shell patterns such as Nishang one-liners

Affected and fixed versions

• Qlik — Qlik Sense Enterprise for Windows
  Vulnerable versions: Builds before August 2023 Patch 2 (CVE-2023-48365)
  Fixed in: August 2023 Patch 2; May 2023 Patch 6; February 2023 Patch 10; November 2022 Patch 12; August 2022 Patch 14; May 2022 Patch 16; February 2022 Patch 15; November 2021 Patch 17
• Apache — ActiveMQ
  Vulnerable versions: Before 5.15.16; 5.16.0 to before 5.16.7; 5.17.0 to before 5.17.6; 5.18.0 to before 5.18.3
  Fixed in: 5.15.16; 5.16.7; 5.17.6; 5.18.3
• Veeam — Backup & Replication
  Vulnerable versions: 12.0.0.1420 up to but not including 12.2.0.334; 12.1.2 and earlier 12.x
  Fixed in: 12.2.0.334

Timeline

• 2023-08-31 Praetorian discloses Qlik Sense CVE-2023-41265 and CVE-2023-41266 (late August 2023); Qlik ships patches in August and September 2023.
• 2023-09-20 Qlik ships a fix for CVE-2023-48365 (DoubleQlik), an incomplete fix for CVE-2023-41265.
• 2023-10-27 CVE-2023-46604 (Apache ActiveMQ OpenWire deserialization RCE) is published; added to CISA KEV on 2023-11-02.
• 2023-11-30 Arctic Wolf reports CACTUS ransomware operators exploiting Qlik Sense flaws for initial access, abusing the Qlik Sense Scheduler to spawn processes.
• 2024-09-07 CVE-2024-40711 (Veeam Backup & Replication unauthenticated RCE, CVSS 9.8) is published; added to CISA KEV on 2024-10-17.
• 2025-01-13 CISA adds Qlik Sense CVE-2023-48365 to the KEV catalog.
• 2026-10-01 Cynet observes PowerShell reverse-shell delivery attempts against Qlik Sense servers at several EU customers within about three minutes (exact day in October 2026 not stated); attempts blocked.
• 2026-11-11 The Hacker News publishes Cynet's findings, including the exposed staging server on locked-ioc-8:8012 holding a Go backdoor and ActiveMQ and Veeam exploits.

Sources cited

Showing 15 of 16 sources, primary sources first.

• NVD CVE-2024-40711 NVD (NIST) · Advisory · 2024-09-07
• NVD CVE-2023-46604 NVD (NIST) · Advisory · 2023-10-27
• NVD CVE-2023-48365 NVD (NIST) · Advisory · 2023-11-15
• CISA KEV: Qlik Sense HTTP Tunneling (CVE-2023-48365) CISA · Government advisory · 2025-01-13
• CISA KEV: Apache ActiveMQ Deserialization (CVE-2023-46604) CISA · Government advisory · 2023-11-02
• CISA KEV: Veeam Backup & Replication (CVE-2024-40711) CISA · Government advisory · 2024-10-17
• Arctic Wolf: Qlik Sense Exploited in CACTUS Ransomware Campaign arcticwolf.com · Research · 2023-11-30
• watchTowr Labs: Veeam Backup & Response RCE (CVE-2024-40711) labs.watchtowr.com · Research
• Veeam KB4649 advisory veeam.com · Vendor report · 2024-09-07
• Qlik: Critical Security fixes for Qlik Sense Enterprise for Windows community.qlik.com · Vendor report
• Praetorian: DoubleQlik - Bypassing the original fix for CVE-2023-41265 praetorian.com · Research
• Northwave: PrickSense - How Cactus exploits Qlik Sense northwave-cybersecurity.com · Research
• Nishang Invoke-PowerShellTcpOneLine.ps1 GitHub · Code repository
• watchTowr Labs CVE-2024-40711 PoC GitHub · Proof of concept
• Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits (The Hacker News) The Hacker News · News · 2026-11-11

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Other reports on CVE-2023-41265

• Cactus Ransomware Exploiting Qlik Sense Servers (CVE-2023-41266, CVE-2023-41265 'ZeroQlik', CVE-2023-48365 'DoubleQlik') - Fox-IT Victim Identification

Previous and next in malware

• ClickFix Attacks Evolve: Malware Hidden in PNG Images and Windows Domain Controller Compromise (Huntress) Previous report
• Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications Next report